# \[PATCH 00/14\] security-bugs doc updates - From: Willy Tarreau \ - Date: 2026-11-09 08:03:35 - List: netdev - Page: https://ratatoskr.run/netdev/2026/11/17895410 - Thread: https://ratatoskr.run/workflows/2026/11/17895410/t.md ```text Hi, Here comes a new batch of updates for the security bugs doc, essentially to make it more readable and to address some of its apparent contradictions for those not reading it entirely. Some additions were made to explain how to send a patch and a reproducer separately, and to ask that first-time reporters send a single report at once first. The first patch looks big, it only reorders paragraphs to fix the current mess resulting from minimal and incremental updates we've done over the last 6 months in reactions to some repeated mistakes found in reports. This accumulation has resulted in certain topics being discussed in a somewhat inconsistent way at different places in the document. Aside this big patch (which only reorders, doesn't change a word, which can be verified with "git show --color-moved", there are 13 small patches each touching a single paragraph. Interestingly, I discovered that the list's address was still present in historic areas of the netdev doc and in submitting-patches, which could be an explanation for the non-negligible amount of reports we receive showing proofs that the doc was never read, so I've fixed that as well. Thanks! Willy -- Willy Tarreau (14): docs: security-bugs: reorganize the document without changing its contents docs: security-bugs: clarify when to Cc the security team docs: security-bugs: never publish reproducers of bugs with a security impact docs: threat-model: clarify the case of automatically mounted file systems docs: security-bugs: explain how to send a fix that can be applied docs: security-bugs: do not send archives or binary attachments docs: security-bugs: first-time reporters must send a single report first docs: security-bugs: explain what to do when a report gets no response docs: security-bugs: reports left unanswered for 7 days will be dropped docs: security-bugs: add a section for maintainers receiving reports docs: security-bugs: explain why directly sent reports add extra work docs: security-bugs: explain why AI-found bugs are handled publicly docs: submitting-patches: defer to security-bugs.rst for security fixes docs: netdev: align the security fixes section with security-bugs.rst Documentation/process/maintainer-netdev.rst | 13 +- Documentation/process/security-bugs.rst | 410 +++++++++++++------ Documentation/process/submitting-patches.rst | 10 +- Documentation/process/threat-model.rst | 23 +- 4 files changed, 310 insertions(+), 146 deletions(-) -- 2.52.0 ```